US6301699B1
Expired / Lapsed
US
⏱️ 0.0 years remaining
Method for detecting buffer overflow for computer security
Assignee: McAfee LLC
•
Filing: 1999-03-18
•
Granted: 2001-10-09
•
Expires: 2019-03-18
Abstract
Abstract Method for detecting buffer overflow weakness exploitation, including the steps of determining a plurality of threshold parameters, each respective to a buffer overflow weakness exploitation event, analyzing a code to be executed, thereby producing a plurality of validation values, comparing said validation values to the respective ones of the threshold parameters, and determining a buffer overflow weakness exploitation attempt, when at least one of the validation values exceeds the respective one of the threshold parameters.
Inventors
- 👤 Yona Hollander
- 👤 Ophir Rahman
- 👤 Shmuel Sagiv
- 👤 Ury Segal
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-06 10:24
CPC Classifications
G; G06; G06F; G06F21/00; G06F21/50; G06F21/55; G06F21/57; G06F21/577
Claims Analysis
Total Claims: 8
Claim 1
Independent Claim
94 words
Method for detecting buffer overflow weakness exploitation, comprising the steps of: determining at least one threshold parameter, each said at least one threshold parameter being respective to a buffer overflow weakness exploitation event, analyzing a code to be executed, thereby producing at least one validation value, comparing said at least one validation value to the respective ones of said at least one threshold parameters, and determining a buffer overflow weakness exploitation attempt, when at least one of said at least one validation value exceeds the respective one of said at least one threshold parameters.
Claim 2
Dependent Claim
94 words
Method for detecting buffer overflow weakness exploitation, comprising the steps of: determining at least one threshold parameter, each said at least one threshold parameter being respective to a buffer overflow weakness exploitation event, analyzing a code to be executed, thereby producing at least one validation value, comparing said at least one validation value to the respective ones of said at least one threshold parameters, and determining a buffer overflow weakness exploitation attempt, when at least one of said at least one validation value exceeds the respective one of said at least one threshold parameters.
Claim 3
Dependent Claim
72 words
The method according to claim 1 , wherein said step of analyzing comprises the steps of: scanning said code thereby detecting jump instructions and target addresses, associating said jump instructions with said target addresses, determining jump instructions which are not associated with any of said target addresses as invalid jump instructions, and determining one of said at least one validation value as a function of the number of said invalid jump instructions.
Claim 4
Dependent Claim
162 words
The method according to claim 2 , wherein said step of analyzing further comprises the steps of: sequentially analyzing the instructions of said code; determining the first instruction of said code as the beginning of a first block; determining each detected jump instruction as an end of a block; determining an instruction which follows each said detected jump instructions as a beginning of a block; determining the jump address of each said detected jump instructions as a beginning of a block; determining an instruction which precedes each said detected jump target address as an end of a block; determining the last instruction of said code as the end of a last block; detecting a system call instruction between each said beginning of a block and the first following end of a block; and determining one of said at least one validation value as a function of the number of detected system call instructions and the number of said beginnings of a block.
Claim 5
Dependent Claim
160 words
The method according to claim 1 , wherein said step of analyzing comprises the steps of: sequentially analyzing the instructions of said code; determining the first instruction of said code as the beginning of a first block; determining each detected jump instruction as an end of a block; determining an instruction which follows each said detected jump instructions as a beginning of a block; determining the jump address of each said detected jump instructions as a beginning of a block; determining an instruction which precedes each said detected jump target as an end of a block; determining the last instruction of said code as the end of a last block; detecting a system call instruction between each said beginning of a block and the first following end of a block; and determining one of said at least one validation value as a function of the number of detected system call instructions and the number of said beginnings of a block.
Claim 6
Dependent Claim
73 words
The method according to claim 4 , wherein said step of analyzing further comprises the steps of: scanning said code thereby detecting jump instructions and target addresses, associating said jump instructions with said target addresses, determining jump instructions which are not associated with any of said target addresses as invalid jump instructions, and determining one of said at least one validation value as a function of the number of said invalid jump instructions.
Claim 7
Dependent Claim
23 words
The method according to claim 1 , further comprising the step of producing an alert when determining said buffer overflow weakness exploitation attempt.
Claim 8
Dependent Claim
25 words
The method according to claim 1 , wherein said step of analyzing comprises analyzing a code to be passed to a parameter as a function.
References Cited (Backward Citations)
US5949973A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2004-10-08 | 2005-04-09 | 2005-10-09 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2008-10-08 | 2009-04-09 | 2009-10-09 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2012-10-08 | 2013-04-09 | 2013-10-09 | $7700.00 | Window Closed / Lapsed |